From 4c21a725728de262dd040f75b07d1b135591af73 Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Mon, 20 Mar 2023 15:12:14 -0600 Subject: [PATCH] Restrict access to /warewulf/config from overlays The wwinit overlay populates /warewulf/config with information about the Warewulf configuration. This includes the IPMI password, which should not be visible to regular users. This changes the installed permissions of the file to be readable by root only. Closes #728 Signed-off-by: Jonathon Anderson --- CHANGELOG.md | 1 + Makefile | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5245f88..688036a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - The correct header is now displayed when `-al` flags are specified to overlay list. +- Restrict access to `/warewulf/config` to root only. (#728, #742) ### Changed diff --git a/Makefile b/Makefile index 2772c723..61e470bc 100644 --- a/Makefile +++ b/Makefile @@ -188,7 +188,7 @@ files: all chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh* chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/NetworkManager/system-connections/ww4-managed.ww chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/etc/ssh/ssh*.pub.ww - chmod 644 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww + chmod 600 $(DESTDIR)$(WWOVERLAYDIR)/wwinit/warewulf/config.ww chmod 750 $(DESTDIR)$(WWOVERLAYDIR)/host install -m 0755 wwctl $(DESTDIR)$(BINDIR) install -m 0755 wwapic $(DESTDIR)$(BINDIR)